Privacy Notice

CASI Pharmaceuticals Inc, and its subsidiaries are committed to respecting and protecting your privacy and understand that information about you, your health, and your health care is sensitive.

This Privacy Notice (“Privacy Notice”) sets forth CASI’s practices regarding the collection, use, and disclosure of information that we may collect or receive from you through our websites, mobile sites, and mobile applications (together, the “Site(s)”), security systems, our offline business-related interactions with you, and other services and products that link to or otherwise reference this Privacy Notice (collectively, the “Services”). Please read the entire Privacy Notice before using our Services.

INFORMATION WE COLLECT

The types of information that CASI may collect and receive from you while you use the Services are described in this section and include both information that you provide to us and information that we collect automatically when you use the Services.

CASI Pharmaceuticals Inc., is a Controller of the personal data you (data subject) provide us. We collect the following types of personal data from you:

· Personal Information: Personal information is information from which an individual can be identified directly or indirectly. We may collect personal information that you provide through the Services, for example, through your completing forms or setting up accounts on the Sites, through an enrolment form in order to register for CASI programs and services, through requests to receive marketing materials and information, or by contacting CASI customer service. This may include information such as your name, postal address, telephone number, email address, date of birth, device and browsing information, such as your IP address, and health, financial and professional information.

· Health data: Pseudonymised (“key coded”) demographic and medical data relating to Data Subjects/patients participating in clinical trials or other forms of medical research, including Data Subject study ID numbers and possibly including initials and/or date of birth. These health data will be processed in order to evaluate the clinical trial hypothesis and to monitor Data Subjects’ safety.

· Google Analytics: The Sites may use Google Analytics, a web analysis service provided by Google, to better understand website usage. Google Analytics collects information such as how often users visit sites, what pages they visit and what other sites they used prior to visiting. Google uses the data collected to track and examine the use of the sites, to share such data with other Google services, or to personalize the ads of its own advertising network. Google’s ability to use and share information collected by Google Analytics is restricted by the Google Analytics Terms of Service and the Google Privacy Policy. Google offers an opt-out mechanism for Google Analytics available here.

We need your personal data in order to provide you with the following services:

• To respond to your requests for information, products, or services;
• To manage or develop our business relationship with you (e.g., to respond to questions, invite you to events, comply with regulatory obligations);
• For our research, development, and collaboration efforts;
• To comply with government regulations; and
• For other everyday business purposes, such as payment processing and financial account management, product development, contract management, Site administration, fulfillment, analytics, fraud prevention, corporate governance, reporting, and legal compliance.

THIRD PARTIES

We may share your information with third parties with whom we have contracted, affiliates and business partners. We will require the recipients to use your personal information only for appropriate purposes and take appropriate measures to protect your personal information under applicable law.

DATA SECURITY AND RETENTION

We have established reasonable physical, electronic and managerial procedures to help prevent unauthorized access, maintain data accuracy, and ensure the correct use of information we collect online.

However, there is always some risk of unauthorized access to our systems. You should take special care in deciding what information you transmit, upload, send, or otherwise submit to CASI. In case of a personal information security incident, as required by applicable laws, we will inform you in a timely manner and report the incident to relevant regulatory authorities.

We retain your information for as long as it is necessary for the purposes set out in this Privacy Policy, unless required by our legal obligations to retain it for longer.

LINKS TO OTHER WEBSITES

The Sites may contain links to third-party websites, which are not operated or controlled by CASI and for which CASI is not responsible. The links from the Sites do not imply that CASI endorses or has reviewed the third-party websites. Once you have left the Site, we are not responsible for the protection and privacy of any information you provide. We suggest contacting those sites directly for information on their privacy policies.

ACCESSING INFORMATION & CONTACTING US

You may contact us at any time if you have questions about this Privacy Policy. Under applicable data protection laws, you may be entitled to access the information we have collected and, where appropriate, request that it be corrected, erased, or restricted or withdraw your consent or object to its use.

CASI has assigned a Data Protection Officer responsible for overseeing CASI’s compliance with EU data protection law, which you may contact at privacy@casipharmaceuticlas.com in case of any questions or concerns regarding the processing of your personal data.

CHANGES TO THIS PRIVACY NOTICE

At times, it may be necessary for us to make changes to this Privacy Notice. We reserve the right to change this Privacy Notice and any of our policies or procedures concerning the treatment of information collected in connection with the Services. Where we make material changes to this Privacy Notice that reflect material changes in how we use your information we may notify you of those changes. Any changes to our Privacy Notice will become effective upon posting of the revised Privacy Notice on the company website. Use of the Services following such changes constitutes your acceptance of the revised Privacy Notice.